We store photos of employees for the intranet. Are those biometric data?

Usually not. Paragraph 1 covers biometric data only when processed for the purpose of uniquely identifying a person. Recital 51 says photos are not systematically a special category; they become one only when processed through technical means that allow unique identification or authentication, such as facial recognition. A photo remains ordinary personal data to which Article 6 applies.

What is the difference between consent and explicit consent?

For special categories, paragraph 2(a) requires explicit consent for one or more specified purposes. This is a stronger form than the consent under Article 6(1)(a): the data subject must clearly and specifically agree to this particular sensitive processing. In addition, Union or national law may provide that the prohibition cannot be lifted by consent in certain cases.

May we process sick leave and health information about employees?

Health data fall under paragraph 1 and are therefore prohibited as a rule. Paragraph 2(b) provides an exception for obligations and rights under employment and social security law, in so far as Union law, national law or a collective agreement allows it with appropriate safeguards. Paragraph 2(h) covers occupational medicine and the assessment of working capacity, but subject to the secrecy condition of paragraph 3. Which exception fits therefore depends on the national rules that apply to you.

Article 9: Processing of special categories of personal dataAI-relevant

Praxikon tracks Article 9 (Processing of special categories of personal data) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IIIn force since 25-05-2018

Article 9 prohibits in paragraph 1 the processing of special categories of personal data: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, and genetic data, biometric data for unique identification, health data and data concerning sex life or sexual orientation. Paragraph 2 lists ten exceptions in which the prohibition does not apply, such as explicit consent (a), obligations under employment law (b), data manifestly made public by the data subject (e) and health care (h). Paragraph 3 ties the health care exception to professional secrecy, and paragraph 4 lets Member States set further conditions for genetic, biometric and health data. The article exists because, according to recital 51, these data are by their nature particularly sensitive and their processing can create significant risks to fundamental rights. An exception under paragraph 2 comes on top of, not instead of, the legal basis under Article 6 (recital 51).

Key term: Special categories of personal data: the sensitive data listed in paragraph 1 whose processing is prohibited unless an exception in paragraph 2 applies

Directly affects:controllerprocessordata subjectmember statedata protection officer

Praxikon’s reading of the text and the recitals; the official text below prevails.

AI Act intersection

Special categories of personal data are relevant for prohibited AI practices (Art. 5 AI Act, biometrics) and data governance (Art. 10 AI Act, bias detection).

AI Act Art. 5 →AI Act Art. 10 →

Official text

Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.

Paragraph 1 shall not apply if one of the following applies: (a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject; (b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject; (c) processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent; (d) processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects; (e) processing relates to personal data which are manifestly made public by the data subject; (f) processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity; (g) processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject; (h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3; (i) processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy; (j) processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies.

Member States may maintain or introduce further conditions, including limitations, with regard to the processing of genetic data, biometric data or data concerning health.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

Decision tree

Do you process special category data, and is that allowed?

Special category data are subject to a prohibition, unless one of the exceptions in Article 9(2) applies. That exception comes on top of a legal basis under Article 6.

Question 1 · Art. 9(1)

Do you process data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, or genetic data, biometric data for uniquely identifying a person, data concerning health, or data concerning a person’s sex life or sexual orientation?

Data from which such a trait can be indirectly inferred can also fall under this. An ordinary photo is only biometric data when processed technically to uniquely identify someone.

Full diagram

1
Do you process data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, or genetic data, biometric data for uniquely identifying a person, data concerning health, or data concerning a person’s sex life or sexual orientation?
Art. 9(1)
- Yes → Question 3
- No → Question 2
2
Do you process data relating to criminal convictions and offences or related security measures?
art. 10
- Yes → Outcome B
- No → Outcome A
3
Has the data subject given explicit consent for one or more specified purposes, and does the law not provide that the prohibition may not be lifted by consent?
Art. 9(2)(a)
- Yes → Outcome C
- No → Question 4
4
Is the processing necessary for obligations or rights in the field of employment, social security or social protection law, and is it authorised by Union or Member State law or a collective agreement with appropriate safeguards?
Art. 9(2)(b)
- Yes → Outcome D
- No → Question 5
5
Is the processing necessary to protect someone’s vital interests, where the data subject is physically or legally incapable of giving consent?
Art. 9(2)(c)
- Yes → Outcome F
- No → Question 6
6
Are you a foundation, association or other not-for-profit body with a political, philosophical, religious or trade union aim, and does it concern only (former) members or regular contacts, without disclosure outside the body without consent?
Art. 9(2)(d)
- Yes → Outcome F
- No → Question 7
7
Has the data subject manifestly made these data public themselves, deliberately and accessible to everyone?
Art. 9(2)(e)
- Yes → Outcome F
- No → Question 8
8
Is the processing necessary for the establishment, exercise or defence of legal claims, or is a court acting in its judicial capacity?
Art. 9(2)(f)
- Yes → Outcome F
- No → Question 9
9
Is the processing necessary for preventive or occupational medicine, assessment of working capacity, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services, on the basis of Union or Member State law or a contract with a health professional, by or under the responsibility of a professional subject to professional secrecy?
Art. 9(2)(h) · Art. 9(3)
- Yes → Outcome E
- No → Question 10
10
Is the processing necessary for reasons of substantial public interest, public health, or for archiving, scientific or historical research or statistical purposes, on the basis of Union or Member State law with suitable and specific safeguards?
Art. 9(2)(g), i en j · art. 29 UAVG
- Yes → Outcome D
- No → Outcome G

Outcome A · Does not apply

No special category or criminal offence data

Article 9 and Article 10 do not apply. You do need a legal basis under Article 6. Watch out for inferred data: a system that predicts sensitive traits can still create special category data.

Art. 9(1) · art. 10 · Art. 6(1)

Outcome B · Check further

Criminal offence data: Article 10, not Article 9

You may only process these data under the control of official authority or where Union or Member State law authorises it with appropriate safeguards. In the Netherlands the UAVG (the Dutch GDPR Implementation Act) sets out in a separate section on criminal offence data when this is allowed. You also need a legal basis under Article 6.

art. 10 · Art. 6(1)

Outcome C · Applies

Allowed on the basis of explicit consent

Record how and when the explicit consent was given and make withdrawal easy. You also need a legal basis under Article 6. For large-scale processing a DPIA is mandatory (Article 35(3)(b)).

Art. 9(2)(a) · art. 7 · Art. 6(1) · Art. 35(3)(b)

Outcome D · Applies

Allowed on the basis of a statutory rule

Name the specific statutory provision or collective agreement clause and apply the safeguards it contains. Do not process more than needed for that purpose. You also need a legal basis under Article 6. For large-scale processing a DPIA is mandatory (Article 35(3)(b)).

Art. 9(2)(b), g, i en j · Art. 6(1) · Art. 35(3)(b)

Outcome E · Applies

Allowed for care or occupational medicine under secrecy

The processing must be carried out by or under the responsibility of a professional subject to professional secrecy, such as a doctor or occupational physician. An employer cannot process medical data itself through this exception; for sickness absence and reintegration, Article 30 UAVG gives employers only limited room via Article 9(2)(b). You also need a legal basis under Article 6. For large-scale processing a DPIA is mandatory (Article 35(3)(b)).

Art. 9(2)(h) · Art. 9(3) · art. 30 UAVG · Art. 6(1) · Art. 35(3)(b)

Outcome F · Applies

Allowed under a specific exception

Record which exception in paragraph 2 you rely on and why its conditions are met. Keep the processing limited to what that exception covers. You also need a legal basis under Article 6. For large-scale processing a DPIA is mandatory (Article 35(3)(b)).

Art. 9(2)(c), d, e of f · Art. 6(1) · Art. 35(3)(b)

Outcome G · Prohibited

Prohibited: no exception applies

Without an exception under paragraph 2 you may not process these data, not even with a legal basis under Article 6. Stop the processing, delete the data or design the process so that no special category data are needed.

Art. 9(1) · Art. 9(2)

What does this mean for you?

Controller

First establish whether you process data listed in paragraph 1, including where you infer them from other data, then determine which exception in paragraph 2 applies; record both. If you ask for explicit consent (paragraph 2(a)), this goes beyond ordinary consent and must name specified purposes. If you use AI, for example, to uniquely recognise faces in photos, those are biometric data under recital 51; an ordinary photo without such technical processing is not. Also check whether your Member State sets further conditions for genetic, biometric or health data (paragraph 4).

Processor

Know whether you process special categories for the controller, because the safeguards that belong to the exception, such as secrecy in health care (paragraph 3), must also be in place on your side. If you use these data for your own purposes, you are the controller for that part and need your own exception under paragraph 2 and a legal basis under Article 6.

Data Protection Officer

For each project, test whether special categories are involved and whether the chosen exception in paragraph 2 genuinely fits; 'manifestly made public by the data subject' (e), for example, requires that the data subject did this themselves. Remind the organisation that a legal basis under Article 6 is needed in addition to an exception under paragraph 2 (recital 51).

Data Subject

Your sensitive data may not be processed as a rule (paragraph 1). If an organisation asks you for explicit consent, it must be clear for which specified purposes this is (paragraph 2(a)). Recital 54 says that health data processed for reasons of public health may not be used by employers, insurers or banks for other purposes.

Compliance checklist

For every processing operation it has been assessed whether special categories of data under Article 9(1) are processed, including where they are inferred from other data.For every processing of special categories it is recorded which exception in Article 9(2) applies.In addition to the exception under Article 9(2), a legal basis under Article 6(1) is recorded (recital 51).Where explicit consent is relied on, it was given for one or more specified purposes and it has been checked whether the law rules out consent in this case (Article 9(2)(a)).Where processing is for health care or occupational medicine, it is carried out by or under the responsibility of someone bound by professional secrecy or a duty of confidentiality (Article 9(3)).Where substantial public interest, public health or research is relied on, the Union or national provision is identified and the safeguards it requires are in place (Article 9(2)(g), (i) and (j)).For genetic, biometric or health data it has been checked whether national law sets further conditions or limitations (Article 9(4)).Photos and images are treated as biometric data only when they are technically processed for unique identification (Article 9(1) and recital 51).

Related recitals

(51)

Personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the context of their processing could create significant ri...

(52)

Derogating from the prohibition on processing special categories of personal data should also be allowed when provided for in Union or Member State law and subject to suitable safeguards, so as to pro...

(53)

Special categories of personal data which merit higher protection should be processed for health-related purposes only where necessary to achieve those purposes for the benefit of natural persons and ...

(54)

The processing of special categories of personal data may be necessary for reasons of public interest in the areas of public health without consent of the data subject. Such processing should be subje...

(55)

Moreover, the processing of personal data by official authorities for the purpose of achieving the aims, laid down by constitutional law or by international public law, of officially recognised religi...

(56)

Where in the course of electoral activities, the operation of the democratic system in a Member State requires that political parties compile personal data on people's political opinions, the processi...

Cross-references

Art. 89: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

In addition to the overview at the bottom of this page: rulings, guidelines and fines that interpret or apply this article, newest first. Each item was checked against the official source.

Case law (5)

19 December 2024 · C-65/23 · CJEU
MK v K GmbH
A collective or works agreement on employee data must also comply with Articles 5, 6 and 9 of the GDPR, and courts fully review its necessity.
21 December 2023 · C-667/21 · CJEU
Krankenversicherung Nordrhein
Processing health data under an exception in Article 9(2) also requires a legal basis under Article 6. Compensation has a compensatory, not a punitive, function.
1 August 2022 · C-184/20 · CJEU
OT v Vyriausioji tarnybinės etikos komisija
Data that indirectly reveal sensitive information, such as a partner's name revealing sexual orientation, fall under Article 9. Publishing declarations of interests online went further than necessary.
24 September 2019 · C-136/17 · CJEUDirective 95/46
GC and Others v CNIL
The prohibition on processing special category and criminal data also applies to a search engine, within its role when assessing a de-referencing request. For outdated reports on criminal proceedings, the current situation must appear first in the results.
6 November 2003 · C-101/01 · CJEUDirective 95/46
Lindqvist
Naming people on a web page is automated processing that falls outside the household exemption; a foot injury is health data, and uploading to an EU-hosted site is not a transfer to a third country.

Guidelines and decisions (6)

17 September 2026 · v2.0 · EDPB
Guidelines 3/2025 on the interplay between the DSA and the GDPR
Describes how obligations under the Digital Services Act and the GDPR apply together, including for content moderation, recommender systems and advertising.
19 November 2025 · COM(2025) 837 · European Commission
Digital Omnibus: proposal amending the GDPR
Legislative proposal that would introduce, among other things, a relative definition of personal data, breach notification only for high risk and cookie rules within the GDPR itself. It is a proposal, not law in force.
13 April 2021 · v2.1 · EDPB
Guidelines 8/2020 on the targeting of social media users
Describes the roles and responsibilities of social media platforms and advertisers in targeted advertising and the legal bases that fit.
9 March 2021 · v2.0 · EDPB
Guidelines 01/2020 on processing personal data in the context of connected vehicles and mobility related applications
Addresses data protection for connected vehicles and mobility apps, such as location data, biometrics and access to data stored in the vehicle.
15 December 2020 · v2.0 · EDPB
Guidelines 06/2020 on the interplay of the Second Payment Services Directive and the GDPR
Addresses how payment service providers under PSD2 may process personal data, with attention to legal basis, third party data and special categories.

Show 1 more

29 January 2020 · v2.1 · EDPB
Guidelines 3/2019 on processing of personal data through video devices
Covers video surveillance under the GDPR, including the household exemption, legal basis, biometric data, transparency duties and storage periods.

Fines (1)

16 May 2024 · Dutch Data Protection Authority€30,500,000
Clearview AI: illegal database of face prints
Clearview scraped billions of photos from the internet and turned faces into biometric codes, without a legal basis and in breach of the ban on processing biometric data. It did not inform people, ignored access requests and had no representative in the EU.
Decision of 16 May 2024, announced on 3 September 2024. Clearview did not object, so the fine is final. The AP imposed no separate fine for the missing EU representative (Article 27).

Line of case lawSpecial categories of data

When do data reveal something sensitive?

Lindqvist (2003)A foot injury is already health data.
GC and Others v CNIL (2019)The prohibition also applies to search engines handling de-referencing requests.
OT v Vyriausioji tarnybinės etikos komisija (2022)Indirect revelation, such as through a partner's name, also counts.
Meta Platforms v Bundeskartellamt (2023)Browsing on sensitive sites can yield special category data.
Krankenversicherung Nordrhein (2023)Besides an Article 9 exception, an Article 6 basis is always needed.
Lindenapotheke (2024)Online orders for pharmacy medicines are health data.
Schrems v Meta Platforms (2024)A public statement about one's orientation does not free up other data on it.
Russmedia Digital (2025)A marketplace must screen ads with sensitive data in advance.

Checked on 5 November 2026

Frequently asked questions

← Art. 8: Conditions applicable to child's consent in relation to information society services Art. 10: Processing of personal data relating to criminal convictions and offences →

Connections

Themes where this returns

Where this meets the other law

Emotion recognition: prohibited or high-risk under the AI Act, with the GDPR alongside
applies alongside
Special categories of data for bias detection: Article 4a alongside Article 9 GDPR
own conditions on top of

The counterpart in the other law

Case law

Schrems v Meta: no unlimited retention and aggregation of data for targeted advertising
2024-10-04 · final, Hof van Justitie van de EU (Vierde kamer), Maximilian Schrems tegen Meta Platforms Ireland Limited
Lindenapotheke: competitors may sue over GDPR breaches and pharmacy order data are health data
2024-10-04 · final, Hof van Justitie van de EU (Grote kamer), ND tegen DR (twee Duitse apothekers)
Meta v Bundeskartellamt: competition authority may find a GDPR breach, strict conditions for legal bases behind personalised advertising
2023-07-04 · final, Hof van Justitie van de EU (Grote kamer), Meta Platforms Inc., Meta Platforms Ireland Ltd en Facebook Deutschland GmbH tegen Bundeskartellamt
Russmedia: an online marketplace operator is controller for personal data in adverts and must check before publication
2025-12-02 · final, Hof van Justitie van de EU (Grote kamer), X tegen Russmedia Digital SRL en Inform Media Press SRL

Guidelines

Guidelines 03/2026 on web scraping in the context of generative AI
2026-07-07 · under consultation, European Data Protection Board (EDPB)
Guidelines 05/2020 on consent under Regulation 2016/679
2020-05-04 · final, European Data Protection Board (EDPB)
Guidelines 1/2026 on processing of personal data for scientific research purposes
2026-04-15 · under consultation, European Data Protection Board (EDPB)
EDPB and EDPS adopt Joint Opinion 2/2026 on the Digital Omnibus
2026-02-10 · final, European Data Protection Board en European Data Protection Supervisor

Enforcement and fines

Ten municipalities fined a total of 250,000 euros for unlawful files on Muslim residents
2026-02-03 · final, Autoriteit Persoonsgegevens
Formal warning to the Dutch Minister of Education, Culture and Science not to put the CABR war archive online and searchable
2024-11-26 · final, Autoriteit Persoonsgegevens
Clearview AI: 30.5 million euro fine and penalty orders for illegal facial database
2024-05-16 · final, Autoriteit Persoonsgegevens

Legislation in motion

Proposal: exception for incidental special category data in AI development (Article 9(2)(k) and 9(5) GDPR)
2025-11-19 · proposal, Europese Commissie
Proposal: exception for biometric verification under the data subject's sole control (Article 9(2)(l) GDPR)
2025-11-19 · proposal, Europese Commissie
Council: Irish Presidency continues with a revised compromise, Antici Group 11 September 2026
2026-09-11 · under negotiation, Raad van de Europese Unie, Iers voorzitterschap
Council: Cyprus Presidency tables negotiating mandate, Coreper vote of 26 June 2026 cancelled
2026-06-22 · under negotiation, Raad van de Europese Unie, Antici-groep (vereenvoudiging) en Coreper
Commission publishes Digital Omnibus proposal COM(2025) 837
2025-11-19 · proposal, Europese Commissie